CVE-2017-1000486

README - CVE-2020-1039909 Primefaces Remote Code Execution ============================================================ SOBRE A VULNERABILIDADE CVE-2020-1039909 e uma vulnerabilidade de execucao remota de codigo RCE no framework Primefaces JSF. A falha permite que um atacante execute comandos...

Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

EUVD-2026-62603

Orval: Import-time RCE via array-items default - zod module-level template literal...

Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-8J6P-R8JG-MXQH Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

NPM: Orval: Import-time RCE via enum-typed default -> zod module-level template literal

NPM: Orval: Import-time RCE via enum-typed default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

CVE-2026-84736

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...

SUSE CVE-2026-55857

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

EUVD-2026-70599

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...

Linux Distros Unpatched Vulnerability : CVE-2026-70399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servic...

PT-2026-85084

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS CERTIFICATE VALIDATION environment variable is unset or set to false, the...

PT-2026-85050

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK's pathsec.py security module defaults to ENFORCE=False line 24, which means all 8 security validation functions only emit RuntimeWarning instead of raising exceptions when violations are detected. The pathsec module was introduced as the fix for CVE-2024-39705 arbitrary code execution via...

GHSA-P3M8-78J2-G5P3 NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK's pathsec.py security module defaults to ENFORCE=False line 24, which means all 8 security validation functions only emit RuntimeWarning instead of raising exceptions when violations are detected. The pathsec module was introduced as the fix for CVE-2024-39705 arbitrary code execution via...

NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Lack of transparency in JFrog Artifactory

JFrog has identified a vulnerability in JFrog Artifactory. This vulnerability resides in the default configuration of JFrog Artifactory, where insufficient authentication controls are in place. As a result, an unauthenticated attacker can escalate their privileges to administrative level using...